Acknowledgement emails sent despite being off in the rule, Acknowledged alerts not disappearing

Help
1

As the title says, Alert recovery is Off in the rule, I still get 2 emails per alert 1 when it happens, 1 when I click acknowledge.

rule:
https://turbomrak.ddns.net/s/yT7BnaaCxDPeQse

./validate.php output:
librenms@nms:~$ ./validate.php

Component Version
LibreNMS 1.54-39-g36c41bac2
DB Schema 2019_07_09_150217_update_users_widgets_settings (140)
PHP 7.2.9-1+b2
MySQL 10.3.15-MariaDB-1
RRDTool 1.7.1
SNMP NET-SNMP 5.7.3
====================================

[OK] Composer Version: 1.9.0
[OK] Dependencies up-to-date.
[OK] Database connection successful
[OK] Database schema correct
[FAIL] Some folders have incorrect file permissions, this may cause issues.
[FIX]:
sudo chown -R librenms:librenms /opt/librenms
sudo setfacl -d -m g::rwx /opt/librenms/rrd /opt/librenms/logs /opt/librenms/bootstrap/cache/ /opt/librenms/storage/
sudo chmod -R ug=rwX /opt/librenms/rrd /opt/librenms/logs /opt/librenms/bootstrap/cache/ /opt/librenms/storage/
Files:
/opt/librenms/bootstrap/cache/packages.php

No use fixing the permisison error on packages.php - it will only go away until next daily.sh run, because ./daily.sh causes it. I’ve seen it reported before, and it’s easy to reproduce: fix the permissions, run ./daily.sh, packages.php will have wrong perms again even if no update is performed.

Alerts from the OS updates rule will go away in a bit once acknowledged, however I use another rule (the failed auth from syslog default one), and these alerts not only sent out the acknowledgement email, but once acknowledged they persist in the Alert screen (for 3 days now).

English is not my 1st language so maybe I just misunderstand something in the documentation, but basically what I want to achieve is, the alerts only sending the Alert mails, and upon acknowledging them they will silently disappear. How to achieve this?

Thanks!

2

I’ve managed to work around the failed auth acknowledged alerts not disappearing, by setting $config[‘syslog_purge’] = 1; in config.php, which has a downside of losing any syslog entries older than 24 hours. Would still prefer a way for the info staying in the syslog, but the alert disappear on acknowledging if that’s possible somehow.

As for the original issue, all my rules have Recovery alerts off, and they all still send out recovery emails anyway.

3

If I get it right, you alerts are built out of syslog data. If yes, you can add a condition in your alert to only look the last 24 hours to build the alert, that would allow you to keep the syslogs in the DB and still having your workaround.

Now, concerning your issue at first, there is no way to remove the ACK email as far as I know. Only the Recovery emails can be disabled right now, and it works well (that’s precisely why your workaround works)

4

Thanks! I’ll have a look at adjusting the rule instead of purging the syslog. Also I now see I was confusing recovery and acknowledgement emails.